CVE-2025-20758: Mediatek Nr15 Modem DoS Vulnerability

CVE-2025-20758 Overview

CVE-2025-20758 is a Denial of Service vulnerability affecting the modem component in numerous MediaTek chipsets. The vulnerability exists due to an uncaught exception in the modem firmware that can be triggered remotely, causing a system crash. This flaw allows an attacker operating a rogue base station to cause affected devices to crash without requiring any user interaction or additional execution privileges.

The vulnerability is classified as CWE-248 (Uncaught Exception), indicating improper handling of exceptional conditions within the modem's signal processing logic. When a User Equipment (UE) device connects to a malicious base station controlled by an attacker, specially crafted network signals can trigger an unhandled exception condition, resulting in a complete system crash and denial of service.

Critical Impact

Remote denial of service attack possible via rogue base station - no user interaction required. Affects over 60 MediaTek chipsets used in smartphones and tablets worldwide.

Affected Products

• MediaTek NR15, NR16, NR17, NR17R (5G Modem Firmware)
• MediaTek Dimensity Series (MT6833, MT6853, MT6873, MT6877, MT6878, MT6879, MT6883, MT6885, MT6889, MT6893, MT6895, MT6896, MT6897, MT6980, MT6983, MT6985, MT6989, MT6990, MT6991)
• MediaTek Helio Series (MT6813, MT6835, MT6855, MT6875, MT6880, MT6886, MT6890, MT6891, MT6899)
• MediaTek Tablet Chipsets (MT8673, MT8675, MT8676, MT8678, MT8755, MT8771, MT8791, MT8792, MT8793, MT8795T, MT8797, MT8798, MT8863, MT8873, MT8883, MT8893)
• MediaTek Modem Chips (MT2735, MT2737)

Discovery Timeline

• December 2, 2025 - CVE-2025-20758 published to NVD
• December 3, 2025 - Last updated in NVD database

Technical Details for CVE-2025-20758

Vulnerability Analysis

This vulnerability resides in the modem firmware component of MediaTek chipsets, specifically affecting the exception handling mechanisms within the baseband processor. The CVSSv3.1 score of 4.9 (Medium severity) reflects the network-based attack vector with high privileges required, though no user interaction is necessary for exploitation.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H indicates:

• Attack Vector (AV:N): Network-based exploitation through cellular communication
• Attack Complexity (AC:L): Low complexity once rogue infrastructure is established
• Privileges Required (PR:H): High privileges needed (rogue base station operation)
• User Interaction (UI:N): No user interaction required
• Scope (S:U): Impact limited to the vulnerable component
• Availability Impact (A:H): High availability impact resulting in system crash

The Exploit Prediction Scoring System (EPSS) indicates a 0.306% probability of exploitation, placing this vulnerability in the 53rd percentile of all CVEs tracked.

Root Cause

The root cause is an uncaught exception (CWE-248) in the modem firmware's signal processing routines. When the modem receives malformed or unexpected data from a cellular base station, the firmware fails to properly handle the exceptional condition through appropriate try-catch mechanisms or error handling routines. This lack of defensive programming allows the exception to propagate uncaught, ultimately causing the modem firmware to crash and triggering a system-wide denial of service.

The vulnerability is tracked internally by MediaTek as Patch ID: MOLY01673755 and Issue ID: MSV-4647.

Attack Vector

The attack requires an adversary to operate a rogue base station (also known as an IMSI catcher or fake cell tower) within radio range of potential victims. The attack flow proceeds as follows:

1. The attacker deploys a rogue base station that mimics legitimate cellular infrastructure
2. A victim's device with an affected MediaTek chipset connects to the rogue base station (either through signal strength manipulation or network selection attacks)
3. The attacker transmits specially crafted signaling messages or malformed network protocol data
4. The modem firmware encounters an exceptional condition it cannot handle
5. The uncaught exception causes the modem firmware to crash
6. The system experiences a denial of service, potentially requiring a device restart

This attack is particularly concerning as it requires no user interaction - the victim simply needs to be within range of the rogue base station for their device to potentially connect and be affected.

Detection Methods for CVE-2025-20758

Indicators of Compromise

• Unexpected device crashes or reboots, particularly in areas with weak cellular coverage
• Modem-related crash logs indicating unhandled exceptions in baseband firmware
• Device connection logs showing repeated connections to unknown or suspicious cell towers
• Abnormal cellular network behavior such as frequent network re-registrations

Detection Strategies

Organizations can implement the following detection strategies:

1. Mobile Device Management (MDM) Monitoring: Deploy MDM solutions capable of collecting crash analytics and identifying patterns of modem-related system crashes across managed devices

2. Cellular Network Analysis: Monitor for anomalies in cellular tower connections, including connections to previously unknown base stations or rapid switching between towers

3. Firmware Version Auditing: Regularly audit MediaTek-based devices to verify they are running patched firmware versions that address MOLY01673755

4. Crash Report Analysis: Analyze system crash reports for patterns indicating modem firmware exceptions, particularly crashes coinciding with cellular network activity

Monitoring Recommendations

Security teams should implement comprehensive monitoring for devices containing affected MediaTek chipsets:

• Enable detailed logging of cellular connectivity events where supported
• Configure crash reporting to aggregate modem-related failures for analysis
• Establish baseline metrics for normal device crash rates to identify anomalous patterns
• Consider network-level monitoring in sensitive environments to detect potential rogue base station activity
• Deploy SentinelOne Singularity Mobile for endpoint visibility and anomaly detection on mobile devices

How to Mitigate CVE-2025-20758

Immediate Actions Required

• Apply the MediaTek security patch identified by Patch ID MOLY01673755 as soon as device manufacturers release updates
• Check with device manufacturers (OEMs) for security bulletins addressing this vulnerability
• Enable automatic security updates on affected devices where possible
• Advise users to be cautious in areas where rogue base stations may be deployed (high-security events, protest areas, international travel)

Patch Information

MediaTek has released patches addressing this vulnerability as documented in their December 2025 Product Security Bulletin. The patch is identified as:

• Patch ID: MOLY01673755
• Issue ID: MSV-4647

Organizations should consult the official MediaTek security bulletin at https://corp.mediatek.com/product-security-bulletin/December-2025 for detailed patch information. Note that firmware updates for end-user devices must be distributed through device manufacturers (OEMs) as MediaTek supplies chipsets rather than consumer devices directly.

Workarounds

Until patches can be applied, consider the following workarounds to reduce exposure:

1. Network Selection Management: Where device management allows, configure devices to connect only to known, trusted cellular networks and avoid automatic network selection

2. Airplane Mode in High-Risk Areas: In environments where rogue base station attacks are suspected, temporarily enabling airplane mode can prevent exploitation

3. Wi-Fi Prioritization: Prioritize Wi-Fi connectivity over cellular data in controlled environments to reduce cellular modem activity

4. Device Isolation: For highly sensitive operations, consider using devices with non-MediaTek chipsets until patches are available

# Example: Check for MediaTek chipset on Android device via ADB
adb shell getprop ro.hardware
adb shell getprop ro.board.platform

# Check current firmware version for patch status
adb shell getprop gsm.version.baseband